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How to use WhoiXML API in Combination with Maltego for Advanced 
Mapping and Reconnaissance of the Emotet Botnet - An Analysis 


Executive Summary 


The Emotet botnet continues making headlines in terms of its widespread spam and malicous 
software serving campaigns on a daily basis and with more researchers trying to profile and infiltrate 
it in terms of shutting it down or monitoring it we’ve decided to take a closer look at the modern 
Emotet botnet using Maltego and WhoisXML API's integration for the purpose of providing timely and 
relevant including actionable threat intelligence and high-value information on its network 
infrastructure potentially offering clues as to the whereabouts of its network operators. 


We've decided to take a closer look at the Emotet botnet C&C infrastructure using publicly accessible 
and obtainable information on its C&C infrastructure using Maltego and WhoisXML API for the 
purpose of OSINT enrichment and to actually offer actionable and relevant threat intelligence type of 
information on the current whereabouts of the Emotet botnet. 


In this research and analysis we'll use a sample seed malicious Emotet known and confirmed botnet 
C&C malicious and fraudulent IPs for the purpose of enrichment and will offer a detailed peek inside 
its network infrastructure including to offer additional set of malicious MD5s which we stumbled upon 
while profiling it for the purpose of assisting security researchers including clients and customers on 
their way to stay on the top of their game in terms of the Emotet botnet. 


01. Introduction to WHOIS XML API 


WhoisXML API is one of the Web’s and the security industry’s primary destinations for threat 
intelligence and cybercrime research, including OSINT types of domain, IP, and current and historical 
WHOIS data records with billions of domain, IP, and WHOIS records within WhoisXML API’s 
database. Novice and experienced cybercrime researchers and threat intelligence analysts, including 
OSINT experts and analysts, should consider adopting WhoisXML API's products in their arsenal of 
OSINT tools and public database repositories and databases, largely considering the tools offered as 
their primary information sources and threat intelligence gathering solutions and publicly accessible 
databases for using them in their current and ongoing OSINT and cybercrime analyses including 
threat intelligence type of investigations. 


02. How to get a proper account 


Cybercrime researchers and threat intelligence analysts interested in obtaining access to one of the 
Web’s and the industry’s most comprehensive and in-depth data set of real-time and historical 
domain IP and WHOIS information should grab an account from the following URL - 
https://main.whoisxmlapi.com/signup for the purpose of beginning their OSINT and cybercrime 
research including their threat hunting and threat intelligence gathering process. 


Product Tier 1 Tier 2 Tier 3 Tier 4 Tier 5 Tier 6 Units 

WHOIS and Bulk WHOIS 100,000 500,000 1,000,000 2,000,000 5,000,000 10,000,000 Monthly queries 
Domain Availability 100,000 500,000 1,000,000 2,000,000 5,000,000 10,000,000 Monthly queries 
IP Geolocation 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
IP Netblocks 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
DNS Lookup 100,000 200,000 500,000 1,000,000 2,000,000 4,000,000 Monthly queries 
Email Verification 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
Domain Reputation 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
Website Categorization 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
Website Contacts 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 


Sample WhoisXML API Pricing Plans Web Site 
03. How to install Maltego 


For the purpose of this case study we’ll use the popular OSINT gathering and enrichment tool 
Maltego, which you can grab from the following URL - https:/Avww.maltego.com/downloads/ on your 
way to begin using and utilizing WhoisXML API’s advanced domain, IP, and historical and current 
WHOIS information and one of the Web’s and the industry’s most comprehensive and in-depth 
database. 


—— Maltego for Windows 


SELECT A FILE TYPE 


.exe + Java (x64) v 


https://maltego-downloads.s3.... re 


You can view our change loghere > 


Java 11 64 bit is recommended. 
Sample Maltego Download Web Site 
04. How to use the WHOIS XML API Maltego Integration 
Before using Maltego users should follow the instructions and grab a proper WhoisXML API account 


which they can later on use for the actual research and OSINT research and analysis, including the 
actual enrichment process. 


ZA 


a SN eae thefres hs tuffs .at 


To Domains and IP Addresses (Historical Reverse WHOIS Search) [WhoisXML] 


To Domains and IP Addresses (Reverse WHOIS Search) [WhoisXML] 


$A0:40:02 UTC 


hos tingerza.net 


SUOJSUeI | 


To Historical WHOIS Records [WhoisXML] 


To WHOIS Records [WhoisXML] 


BxGvFK toa? 


Sample Maltego GUI Interface relying on WHOIS XML API’s for OSINT research and analysis and 
actual network and domain reconnaissance and footprint including actual enrichment 


Users should then proceed with the actual OSINT research and enrichment process by importing the 
domains and actual IPs for their research in questions directly into Maltego by using the import 
feature or by manually adding them for the purpose of actually beginning the actual OSINT 
enrichment and research process. 


05. Profiling a Emotet’s Botnet Command and Control Infrastructure - A Case Study 


We've decided to use Maltego in combination with WhoisXML API's integration for the purpose of 
doing an OSINT enrichment and actual research and analysis on the current state of the Emotet 
botnet in particular the actual botnet C&C infrastructure with the idea to provide actionable 
intelligence on the related malicious and fraudulent IPs including the actual malicious MD5s known to 
be participating in the campaign for the purpose of demonstrating how to use Maltego in combination 
with WhoisXML API for the purpose of establishing the foundations for a successful OSINT 
enrichment campaign and actual botnet C&C infrastructure profiling. 
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Sample Maltego Graph Analysis of a currently active Emotet Botnet C&C infrastructure 


In the initial set of data we’ve decided to collect publicly accessible and well-known by the community 
Emotet botnet C&C IPs and try to enrich them and offer additional clues as to the whereabouts of the 
Emotet botnet in its present state including to offer and provide actual enriched malicious IPs and 
related MD5s known to have been participating in the campaign. 


Sample initial data set IPs part of Emotet’s known C&C infrastructure that we used for this 
OSINT enrichment case study: 
hxxp://109.123.78.10 
hxxp://66.54.51.172 
hxxp://108.161.128.103 
hxxp://195.210.29.237 
hxxp://5.35.249.46 
hxxp://5.159.57.195 
hxxp://206.210.70.175 
hxxp://88.80.187.139 
hxxp://188.93.174.136 
hxxp://130.133.3.7 
hxxp://162.144.79.192 
hxxp://79.110.90.207 
hxxp://72.18.204.17 
hxxp://212.129.13.110 
hxxp://66.228.61.248 
hxxp://193.171.152.53 
hxxp://129.187.254.237 
hxxp://178.248.200.118 
hxxp://133.242.19.182 
hxxp://195.154.243.237 
hxxp://80.237.133.77 
hxxp://158.255.238.163 
hxxp://91.198.174.192 
hxxp://46.105.236.18 
hxxp://205.186.139.105 
hxxp://72.10.49.117 
hxxp://133.242.54.221 
hxxp://198.1.66.98 
hxxp://148.251.11.107 
hxxp://213.208.154.110 
hxxp://192.163.245.236 
hxxp://88.80.189.50 
hxxp://185.46.55.88 
hxxp://173.255.248.34 
hxxp://104.219.55.50 
hxxp://200.159.128.19 
hxxp://198.23.78.98 
hxxp://70.32.92.133 
hxxp://192.163.253.154 
hxxp://192.138.21.214 
hxxp://106.187.103.213 
hxxp://162.144.80.214 
hxxp://128.199.214.100 
hxxp://69.167.152.111 
hxxp://46.214.107.142 
hxxp://195.154.176.172 
hxxp://106.186.17.24 
hxxp://74.207.247.144 
hxxp://209.250.6.60 
hxxp://142.34.138.90 


hxxp://74.217.254.29 
hxxp://212.48.85.224 
hxxp://167.216.129.13 
hxxp://91.194.151.38 
hxxp://162.42.207.58 
hxxp://104.28.17.67 
hxxp://8.247.6.134 
hxxp://5.9.189.24 
hxxp://78.129.213.41 
hxxp://184.86.225.91 
hxxp://107.189.160.196 
hxxp://88.208.193.123 
hxxp://50.56.135.44 
hxxp://184.106.3.194 
hxxp://185.31.17.144 
hxxp://67.19.105.107 
hxxp://218.185.224.231 
hxxp://103.201.150.209 
hxxp://104.131.11.150 
hxxp://104.131.208.175 
hxxp://104.236.151.95 
hxxp://104.236.246.93 
hxxp://104.236.99.225 
hxxp://105.224.171.102 
hxxp://109.104.79.48 
hxxp://109.73.52.242 
hxxp://111.67.12.221 
hxxp://112.72.9.242 
hxxp://115.124.109.85 
hxxp://115.71.233.127 
hxxp://117.218.133.244 
hxxp://125.99.106.226 
hxxp://125.99.61.162 
hxxp://128.199.78.227 
hxxp://134.196.209.126 
hxxp://136.243.177.26 
hxxp://138.201.140.110 
hxxp://138.219.214.164 
hxxp://138.68.106.4 
hxxp://142.4.198.249 
hxxp://142.93.88.16 
hxxp://144.139.247.220 
hxxp://147.135.210.39 
hxxp://149.62.173.247 
hxxp://159.203.204.126 
hxxp://159.65.241.220 
hxxp://159.65.25.128 
hxxp://162.144.119.216 
hxxp://162.217.250.243 
hxxp://162.243.125.212 
hxxp://167.114.210.191 
hxxp://169.239.182.217 
hxxp://170.247.122.37 
hxxp://173.212.203.26 
hxxp://174.136.14.100 
hxxp://175.100.138.82 
hxxp://176.250.213.131 


hxxp://176.31.200.136 
hxxp://177.242.214.30 
hxxp://177.246.193.139 
hxxp://178.62.37.188 
hxxp://178.79.161.166 
hxxp://178.79.163.131 
hxxp://179.14.2.75 
hxxp://179.32.19.219 
hxxp://179.40.105.76 
hxxp://181.134.105.191 
hxxp://181.15.180.140 
hxxp://181.15.243.22 
hxxp://181.16.127.226 
hxxp://181.171.118.19 
hxxp://181.189.213.231 
hxxp://181.198.67.178 
hxxp://181.231.72.200 
hxxp://181.28.144.64 
hxxp://181.28.248.205 
hxxp://181.39.134.122 
hxxp://181.48.174.242 
hxxp://183.82.97.25 
hxxp://185.129.93.140 
hxxp://185.86.148.222 
hxxp://185.94.252.27 
hxxp://186.138.56.183 
hxxp://186.144.64.31 
hxxp://186.22.209.16 
hxxp://186.23.146.42 
hxxp://186.23.18.211 
hxxp://186.4.167.166 
hxxp://186.4.234.27 
hxxp://186.83.133.253 
hxxp://186.86.177.193 
hxxp://187.149.41.205 
hxxp://187.163.180.243 
hxxp://187.163.222.244 
hxxp://187.178.9.19 
hxxp://187.188.166.192 
hxxp://187.189.195.208 
hxxp://187.242.204.142 
hxxp://188.166.253.46 
hxxp://189.180.84.115 
hxxp://189.196.140.187 
hxxp://189.209.217.49 
hxxp://190.1.37.125 
hxxp://190.102.226.91 
hxxp://190.112.228.47 
hxxp://190.113.233.4 
hxxp://190.117.206.153 
hxxp://190.145.67.134 
hxxp://190.147.12.71 
hxxp://190.186.203.55 
hxxp://190.186.221.50 
hxxp://190.189.112.116 
hxxp://190.189.204.100 
hxxp://190.19.42.131 


hxxp://190.193.131.141 
hxxp://190.230.60.129 
hxxp://190.246.166.217 
hxxp://190.25.255.98 
hxxp://190.36.88.98 
hxxp://190.55.39.215 
hxxp://190.72.136.214 
hxxp://190.97.10.198 
hxxp://191.97.116.232 
hxxp://195.242.117.231 
hxxp://196.6.112.70 
hxxp://197.211.244.6 
hxxp://198.58.114.91 
hxxp://200.107.105.16 
hxxp://200.123.101.90 
hxxp://200.24.248.206 
hxxp://200.28.131.215 
hxxp://200.32.61.210 
hxxp://200.43.231.10 
hxxp://200.57.102.71 
hxxp://200.58.171.51 
hxxp://200.58.83.179 
hxxp://200.80.198.34 
hxxp://200.85.46.122 
hxxp://201.199.89.223 
hxxp://201.212.24.6 
hxxp://201.219.183.243 
hxxp://201.220.152.101 
hxxp://201.231.44.78 
hxxp://201.238.152.20 
hxxp://201.251.229.37 
hxxp://201.252.229.169 
hxxp://202.83.16.150 
hxxp://203.25.159.3 
hxxp://205.186.154.130 
hxxp://206.189.98.125 
hxxp://211.63.71.72 
hxxp://212.71.234.16 
hxxp://213.120.104.180 
hxxp://216.98.148.136 
hxxp://216.98.148.156 
hxxp://217.113.27.158 
hxxp://217.13.106.160 
hxxp://217.92.171.167 
hxxp://219.74.237.49 
hxxp://222.214.218.136 
hxxp://222.214.218.192 
hxxp://225.153.252.228 
hxxp://77.122.183.203 
hxxp://109.123.78.10 
hxxp://66.54.51.172 
hxxp://108.161.128.103 
hxxp://195.210.29.237 
hxxp://5.35.249.46 
hxxp://5.159.57.195 
hxxp://206.210.70.175 
hxxp://88.80.187.139 


hxxp://188.93.174.136 
hxxp://130.133.3.7 
hxxp://162.144.79.192 
hxxp://79.110.90.207 
hxxp://72.18.204.17 
hxxp://212.129.13.110 
hxxp://66.228.61.248 
hxxp://193.171.152.53 
hxxp://129.187.254.237 
hxxp://178.248.200.118 
hxxp://133.242.19.182 
hxxp://195.154.243.237 
hxxp://80.237.133.77 
hxxp://158.255.238.163 
hxxp://91.198.174.192 
hxxp://46.105.236.18 
hxxp://205.186.139.105 
hxxp://72.10.49.117 
hxxp://133.242.54.221 
hxxp://198.1.66.98 
hxxp://148.251.11.107 
hxxp://213.208.154.110 
hxxp://192.163.245.236 
hxxp://88.80.189.50 
hxxp://185.46.55.88 
hxxp://173.255.248.34 
hxxp://104.219.55.50 
hxxp://200.159.128.19 
hxxp://198.23.78.98 
hxxp://70.32.92.133 
hxxp://192.163.253.154 
hxxp://192.138.21.214 
hxxp://106.187.103.213 
hxxp://162.144.80.214 
hxxp://128.199.214.100 
hxxp://69.167.152.111 
hxxp://46.214.107.142 
hxxp://195.154.176.172 
hxxp://106.186.17.24 
hxxp://74.207.247.144 
hxxp://209.250.6.60 
hxxp://142.34.138.90 
hxxp://74.217.254.29 
hxxp://212.48.85.224 
hxxp://167.216.129.13 
hxxp://91.194.151.38 
hxxp://162.42.207.58 
hxxp://104.28.17.67 
hxxp://8.247.6.134 
hxxp://5.9.189.24 
hxxp://78.129.213.41 
hxxp://184.86.225.91 
hxxp://107.189.160.196 
hxxp://88.208.193.123 
hxxp://50.56.135.44 
hxxp://184.106.3.194 
hxxp://185.31.17.144 


hxxp://67.19.105.107 
hxxp://218.185.224.231 


06. Basic OSINT Enrichment Process 


In this analysis we’ve decided to share the actual findings based on our research which include the 
actual malicious IPs and the actual C&C communication channel domains including the actual MD5s 
known to have participated in the campaign with the idea to assist legitimate cybercrime researchers 
and OSINT analysts on their way to properly profile and participate in additional OSINT enrichment 
and processing efforts. 


Sample Emotet C&C hosting IPs known to have participated in the campaign and to be 
currently participating in a rogue Botnet C&C hosting infrastructure: 


47.88.102.103 
172.67.191.39 
79.127.127.67 
172.217.12.232 
104.21.68.66 
142.250.179.168 
172.217.13.226 
173.194.221.100 
172.217.7.234 
142.250.73.232 
173.194.221.113 
104.21.87.7 
173.194.221.101 
172.217.164.170 
104.193.88.123 
173.194.221.139 
104.193.88.77 
64.233.162.97 
142.250.65.67 
172.217.2.106 
173.194.221.138 
172.217.20.110 
157.240.229.60 
172.217.5.234 
195.208.0.102 
172.217.7.226 
216.239.35.8 
104.21.46.196 
172.67.141.149 
23.37.43.27 
104.20.209.21 
51.254.83.231 
51.68.44.27 
129.250.35.250 
129.250.35.251 
94.130.16.178 
104.16.159.17 
54.38.92.92 
23.51.123.27 
172.217.12.228 
178.124.148.47 
172.217.164.138 
34.194.44.150 


172.217.15.66 
151.139.128.14 
79.127.127.68 
104.16.158.17 
93.184 .220.29 
37.156.147.163 
178.216.250.130 
185.229.29.6 
54.198.239.119 
185.49.85.182 
77.238.123.22 
172.67.129.244 
104.21 .2.253 
91.240.60.19 
185.49.84.241 
95.100.96.224 
45.60.150.224 
209.126.123.13 
172.217.17.104 
172.67.75.164 
151.106.116.14 
104.26.8.205 
74.120.188.204 
23.196.76.23 
172.217.164.174 
104.26.9.205 
151.101.66.133 
172.217.164.142 
172.67.147.133 
172.217.7.138 
142.250.65.78 
172.217.8.10 
172.217.15.104 
23.47.204.33 
23.47.64.24 
142.215.208.235 
23.47.204.7 
17.253.21.203 
23.15.136.53 
17.253.21.208 
23.48.105.43 
17.57.12.11 
23.15.137.53 
54.189.10.237 
184.51.0.218 
172.217.8.3 
72.21.81.200 
173.194.73.95 
195.28.169.8 
10.10.34.35 
89.31.108.3 
20.50.2.20 
142.250.65.65 
104.26.6.55 
192.166.47.85 
99.86.186.71 
35.214.117.149 


172.217.164.163 
103.21.58.122 
185.194.141.58 
173.194.73.101 
79.127.127.9 
172.67.142.66 
179.127.127.115 
64.233.161.113 
151.236.35.134 
173.194.73.139 
173.194.73.100 
51.89.107.116 
150.95.219.152 
185.49.85.39 
173.194.73.113 
142.250.102.188 
216.58.206.234 
172.217.164.168 
172.253.120.188 
194.177.34.116 
172.217.12.234 
185.254.100.25 
172.217.9.195 
51.210.80.126 
172.217.15.106 
82.66.249.102 
172.217.7.228 
172.217.8.2 
172.217.13.67 
172.217.19.227 
142.250.73.238 
8.252.65.126 
172.217.15.65 
172.217.12.238 
8.253.151.249 
94.75.229.248 
35.186.238.101 
205.185.216.42 
111.13.171.6 
47.246.109.108 
47.246.109.109 
172.253.122.188 
111.13.108.121 
111.13.171.5 
111.13.108.123 
111.13.108.122 
172.217.15.78 
172.217.8.13 
173.194.184.135 
172.217.7.170 
59.111.163.254 
172.217.7.131 
94.130.163.40 
223.252.199.69 
123.58.180.77 
94.130.16.179 
223.252.198.124 


223.252.198.123 
142.250.13.188 
178.216.248.179 
59.111.160.194 
185.73.115.2 
64.18.17.135 
142.250.73.206 
59.111.181.166 
78.157.36.80 
165.22.6.204 
206.189.206.249 
37.140.192.209 
78.41.204.30 
185.236.37.98 
23.6.119.33 
151.101.64.217 
151.101.128.217 
151.101.192.217 
212.33.195.42 
54.187.159.182 
116.203.149.169 
52.36.251.83 
104.22.71.197 
17.248.131.230 
104.123.200.28 
52.218.252.72 
172.67.39.148 
151.101.0.217 
104.22.70.197 
151.101.0.176 
144.76.81.68 
104.31.87.135 
104.26.9.195 
127.0.0.1 
172.67.72.121 
104.26.8.195 
142.250.73.234 
172.217.7.202 
142.250.73.202 
172.217.164.162 
104.97.85.54 
172.217.7.132 
142.250.73.195 
157.185.177.205 
79.127.127.74 
13.32.196.131 
13.32.196.199 
13.32.196.194 
13.32.196.133 
52.213.137.28 
157.185.165.41 
72.21.91.29 
104.97.85.29 
172.217.13.72 
67.208.88.198 
172.217.13.78 
67.208.88.211 


99.86.38.18 
172.217.9.196 
173.194.221.102 
172.217.9.202 
13.32.200.109 
185.8.172.111 
158.69.187.205 
142.250.73.228 
13.32.200.12 
13.32.200.25 
162.217.98.146 
51.222.30.164 
72.21.81.240 
142.250.73.227 


Sample MD5s known to have participated in the campaign and are currently communicating 
with the Emotet botnet: 


d502444891a15f060a7aa8e2d78eaa35e41346ac02c81ce34eb1aef8597f32be 
59e8dc10bfa78cc4fb00659f3a5e97 96f0fe855 703abe353819a6292d1f3d2d9 
5fbdab36ff57 56ac8e58c3e56bc4ce4963969499022789a4cea7c783c6c3d7a2 
6d3dc61aa4568b9b1fb8658fe5 15d247 92e736bb587 796bab5e91b144a56a400 
5bf3afa0ac4e11 54fca60e7bf20f1 68e28a0a148401230a2962b6591 e4bbcb70 
921d0bc27d9c2ca26a8d5af2856e442460974b666390c437dd5dcd2f66c7a07d 
7c065534896d3b90f10cc527f1427 2bf6dd 1 df126497f5098e1d0d03a0b69bfea 
a6f3cd4c2ae8b90fdb49e9ccc5cfc467bf56c27 7bbcb654.a04e51b87524582ba 
19e52375e54cabc8bf4aa8c37d6aa5600dcc4d70405e7b44e0a59d937290ef70 
431cbf05a7c29b540566c78f1 7afb4685e6deb405bb4.ac4c2a989d81 cfe4d68c 
14b1ff1a7eb014c761cdaa49a27b0d0360a1 ab568dbdd4d197eab757e597ec0d 
30e36700baac32ffeba1c10e904470be8858527 3f51f942b0fb2346b36b1e13e 
5b127433ee874f7 158dd7 183e5bdaca8b0d0ad2eae7b28f69ce6a59f2bd1018b 
26275434 19e2229e2b3445e4530e270c60b4c7b0b1882757a1 8ab5f729ee62889 
7526436a4dc55a848f0517b1204ca7e7d749cfb3bb62c0237605fb9fb2a2ba5c 
56038022d89df874a7 a3158328b1a2b522b36 1 cb6f028e1 bO3f3eda1 e2b17f88 
e€6308496a22d31 7cf7e5a5469351 c5cf4dc11ef7e47b39e9a97ea85707cbec8a 
a35b999ea8bb3f2388c451 038ebdb66ef75ae727dd11ab/76ea4da3894b488faa 
bd47f14b2c97c3788f13151d31635fdd5566ab7d28cdd2b2f7 fdef8aa79d7412 
42acba42c177df002d6b2ba5cfa9a20ae7 8e5b3e0f67d274bb9a5d10d8199aee 
4655d5e41838228ec40bb602c3ac95f12e0a337f0d3a63f1 5cO50b9dbf3bb691 
5516313218fe66531 bb8ecefcc8fbbfb37a075dd48f68 19421 9f80b6e2cd3aft 
2{6 162ced7b98f2c43dfefaf55febc9112bda1343b8493e2267ec315787d518e 
83162b91a932f87da0762bfa4947 15dd4f06c273cda4494fa05cc3532fb704ec 
b7c92fa1d3d23a9708a69987b8ad4f01 7fd1f09e14447684c5883a402819b3a2 
6a605ccc32e5c547bd6f1a7f581 08c8d91d3c80002d38e7a66357 3bb662de0d6 
8fc7538da256db1b573a096ebfd04 7f3f055dc6b3ad55695c727988765d007e0 
6e252c68ecbO0fa83aba1c58c2e73a8ddfeb78055046c9838c87695ef5a3668c3 
2cafceb03ae7664da68cab086 1f837b43e677d9530d594eb37 13671 2af2ef27f 
dac6609fbf3ca2c2a15bc40cf7 9af9bc5c7c155ccae31636a90e745f132a6e2d 
83978 1b06efc3c0609bbc1 749048336d8661 3de4 1 8f87c6e2126406d59a6c87d 
355be4be28375e 1b9d538183623c63a696f5ec961 83dca5024142d0f06de2195 
6f6480747deb74abbb4c39e9c1 bcebf9852a89bb886809f9 14 1 cff3c944e4a3 
ea8bf79368adc49dd51 61 8ef830b0440edda540af5b08996efb3d33fb7d57a74 
ed03ff77eb8eee6 0c0eaf7 323427 206464d053d35e40f211f75646 1d6cc830dd 
84814627daf5dc0e87c67a5d05ef49c7 132f45e1f47ef1964409101daf266511 
00054.a00efc35255e8df5b24d8 1e102357b951a222bf2afl fd5662e0dc6a134d 
de79dbe3f4bd7a5c6ebe3c007b8d4 ffbbf4c1 9fc7ad30127e7 1ec0a7855f21da 
f854e1 8d7 ed6dbd47a288559e6667 9bda6b626f91 f9fdcedfdedf1317493640b 


674f447b6 7fa648 1c04d7d4c7dc47ecc0d3956c0c7b9006c845efebbc8fb31 Bf 
2c4ca41292c07252bb043dae7697a91c140ba9be8 2fac5cd62c9f9c802959e0d 
4241921870aeb6fee9cef8a4 8cfa99F2 1 89dd6d2e88ea22bff6caf6474d7d3ee0 
c8f5fab9ca9289342ae92ed 1 ef056e687 f906fc40bbcfe2bee55d639157e06f4 
f8ec41acbd141572f40d6f62a2838325980d255ea1 7490767851 bfa250e645e7 
3f33ae4ea87e4c2f3b2c60152da482a116e9c453662ac438b50458e56edcd87c 
bba5332c6f0d44bc3f293584 2dfbcc051f3edb1b7f186a94c66527 1ccca13755 
8053049ccb4c8e1814963a96433e57866b9ba904 1fc6ddfdce95cdb7d46960c8 
924eb76324c5ed9caf4d0a8i1a76ddc3f2a372b74619483f86e0e5fb4 11a3f2d 
f7d87c8a2844948f44a57d1ee3c804c106a51 942ff4 11 0d3ce8780334a7a478F 
b8c2109f68133a0582d5e29d09f1a38562b535eb9bd501d11793e4ab721 8ca40 
eaec9d2fea105c537 9c7ab7109799650a4 89ed8a7b2ac936f8aae31056a62ccb 
c94678f761 73034fe05e4d5d22e00a24a64f461 7ef42f7df73b219d41838d56e 
d6825e0796be863bd54db437039a6095d45 1b0bc9326504352a597fa5547b221 
6452bb100340136bacfe46a6c14d211f409144fe0919768fde8feb52536583a5 
bfad25aff47173d653fc501f575068c3be0c476f1ecda78926f494dbedd15a9e 
350303903aa5a7 066b63be4ac71e134a9036d7c3f44bddd5cda088f792d8e42d 
3d1e476cc4aca5205fc0e1 7a8e3b1 a0c4c0f7340d80abccd0d907 0aeeb9aGi6f 
5438104f416bb8a85e335287 1e0d05b137548134af6 16058ddb3f98bde0d 1353 
81 bfdf839b895eb2e1662f1ea108abe6be9e83cd254c92 765ff886ab8612335c 
8c6389fc67ddcd8b8342a02825b3278e7 722a31 9ccc7 1dbccdd5bbcebb7997a6 
ffd41b936a6a0c7a94a2b6a00db4dd32d5b1 73f5803659ebaff78d57 adef01fa 
29c11ae8589ed628ac393b2f445de1d4743c07aec8b7a95b1247d354aa32480e 
4d18781f33a23c925af01094bdd4f9d1 c94f5a2e36bebe2add6f4fccOf1 92bc2 
8a380e04d3d765df27a743e30ac09d57572a507 1 4eabb9c2d7be108a322a20ca 
520657d4c787ef47085ee60a1 96a654d65439e574b39c45df794fc2b7bfff48d 
75977d3263020c87f5b9b68394c43915fb564624d2597cdcd711c91a93750d48 
b7f859e49de68440a4dee0b87d204f49701 749fdbci42afb4542c90c7fa22803 
84f18b060db22abb3acb3883e0eba5d94 afl 88863d438d2ff7b9e29ca db56f9 
8f338dd3898847d9b9e5chd1fcfc7cd3da57acba9f67c54 1 fOfb6ef6 7f63302c 
1d51d8e9ae1d67cb804fb28024b0496 9fd5888c3befece09547e5506ee946027 
96929bc0d6b4e6563bca34b916ef56248492329520595f70f4d0be25c1f2b05a 
911e951dfff90bbfae0c2d360abc52ece0766b599d0f9e1 77056ce860b51fe7 1 
efb36535ab077b0a70bcb866701cdc3503658a4 7f0aed434a6ee0d48b4826624 
e5a911c260dc73127826adcafcf04947442f465c423b823b05cc05cf686ce998 
£7a641923d31 3ffe0829bf4dffidb26b5af0988053d1e1aeab/cb8aa0afb7588 
£728506d426be49e63f9b2086adf2646101f3ffb4 79e6d53a7 943b3fca09ff7F 
7ca7/1af07895777a5751cc2f6cf1e36c62cebd1c175f129884d55d3628d79477 
82d52d986f4a521f16e0a8e7657a61871fcOc7f4c319abb7/cf5dff48392facd2 
3172427a172f3d348a885a8e691 aa9a52d786079e1d7 11 7cfeff9dacea0d726c 
bc916075af08babba3d12e8bee5ce166e709a54e231 3e3690beffd3836c7d057 
2c7211a44d025ad60822c479051 2fd8c1 73e6f5d87cb7d8a7df6df5bfb4b94f2 
88aa6a357a62445b751ee11303a56a63399cee 1 f646ee88759ca53267157adbb 
ee0096463b435c1 89c6bae52697a0657 ab8c1187cb325627c08be8ce26f4daae 
02622de4a84c051dce772090333dc9039e39Ff11bfe10a7d26b7de34c8191e584 
abd1424b1f25b3aa337a1 202642a18a73f8ebe291 3e0f0f0999eaf2859044b24 
bdc31ecc81076f27b4f28637c2d31047ebc9062a2fda83db2ae840aafbd6e0b8 
3420bd568900354803e2ca6c/7c7af01d54935a21520fec469fc9d6b8acd3a38d 
5631d4e5a760d5a4ec873ae9607e7333b7337aabbe4 16ddde057bf4b08c2aec7 
2912f3a598914122ce7a5ac9a6816467fe3ca8fb6c5159e5d36581 7420d2b04 1 
98eebf017259d5b320 1ca3f75ebc8ab9bd1359edf38027cebc335921df95fb11 
f0e83f121613ebc055945 1f90a89dfc96F7 38fae3d800500c395fc72d54e53e5 
5813d5c959472766c1d32d638caf56e7fd939b42 1fb5870b3c592c6d4c59554b 
720cdcfd8ffc38395c3fa468923d14b805a7 7e07b4 1cb9540abe809be67 793ed 
1ab235c5a9ba88290c009320fc7359f72b42a54d327e7b56d6f5f9c9d 1 762d0d 
31841 3fce87303db0348c26217206a9a1c3920fa734b791c0c10cb1cad134c0e 
eb3d33e8d35429ed88 1 9bcd3e23ab97 988 1 Odfc94fe97458ce1 efedfaNae9c30 


7a2083d97760c329b72ac29444a9254 1 db8301 741 89a2c343d26b93e02f558b8 
f6b8aada7 98c1218289bb635aabce9b0f810eb595f06f53db1 750fdc5921b195 
483bb5bf9138d0b69d 720387 9a86cfid5de6cbd9215cee61b1bfbc55f40d42d4c 
c96625e957c9f1 2ce8ad7074447802938d206b51 4aeb1cd78a8a2c979b447f2c 
087d8d5e47648af973c962824857 7dc33b26d15c1fd74cd38fbd7433f1 f07adc 
72cc66633a854dd8c5c4332 7bebe39ece60150ab851e735bd97 eed4a8c4.a25f5 
1a725fabb240a11d201d323201a3d98eb749ec34d680eace3635d50a44b544ae 
d12aa2ff14346904d556c7 eb8032da7028 7 05ff7 echbf9df742e62542b3ed70a5 
e948d320e129dacea4d022555c03e90d37977b32c45bd581 O0acdf26d896f639 
ac4ad2feeb0e5cee7 925441 6ba88ea2cb/7 2af8bb2e8 135d8208ecdid3db2b08f 
3ec5b5b5923684d91 edf1c5c5ec037f8aa399928be4e32f7 1 7bd8a3b623dbec5 
099ca6c2252e3e94d6199e4ca1ef54cd3fd3fe6820cb 1988a03b93100b3ab685 
b5c5f15901d303d1135b94fc53148c4358be9c36fcd9 114581 ef382901c655236 
41635ffaeb93b8e1c9b3f09f9e45ef338458 7d6e2b8d24cfc72cabca119c7cdd 
2a6076fc8d5cbd48477320f392fc591 7 793 1f8846203757418b062bddfed6902 
0461721df37c8d27491e1ce9708000ce18823a38222ae99102f448eea63d4f13 
17cd84a5e5246dfbd4c9441 7ade88d4a58426b5926689d31 35309191a181b059 
9079ad5b006647ff89970689bbd29367d8fa16a6a242829b42b88d88bfb 78456 
d22cd6a219464a90cfd2cebbaa94727c8efa73d936b68050 1c4495a900069d21 
c82c0ee05026242ce254f01400399f89f69c32e7c84d6ccf85c2cfe6338a4ae6 
d4a74735785dfbfd340064e834462258f9016097da8aa9f92f5fc843e2d22b34 
88714578fbce5ab5765a9c92dd446cfaa5cb30059c2242255d6fcd336cfa2df3 
8c3621bd13695b1426867fe5b2562aa92e3e3 1¢c2f81d149b332718b32a86773 
11e€3497c31 7e0683a8ddcdeed0d76b/a4a77 144b3b42218203a27f848ef22 7 8F 
837b994c1c16a3a7b71a464 1bae8531f3f145893d63434842af05d226e8aa1db 
8c7203746080fe87d79d839504ec4dbbff0e2e6ad2e2c7bc4133ed78c010f77e 
d8433b324f9acfbbfd9df3bc83b883eb2487d9fae9bc98bf3521 de11b63d84fe 
1f4259e2b808cd00fc825f0e39a2b22ff4aea6caad1 75f1e4567dba0bf296dca 
b67a7 114363f1ca7d632d867de1ee600b29c14fd5b7 2062a7 8baebdfa164a3422 
5924b751 7a90ab49af5 1 96fa1088bad29bff3adb93bc101 2c5c3f73a7 1002899 
b7670a2f62f6d914c4d50a5e7d7211e3c039e692c99bba34329223b3cc8768c5 
d832f2'91 2d3ecfaab38929bf883b85034 759f2226 782095d37928d71657f1cb 
9e7dcbab5f3d5d3c891c3269204db2f29ae3a09d 12357969a3024 ffe 15389dF1 
09891d0a5f1ea375ef7d1e686a5584b475af1 f03cfd26a402490664bc102651¢c 
3db96a39a3c568b8d9eed535941f1c4462ddb2c69c2ac6bb1 7a9c8503e8349e5 
8ebce814309a 1 4efaf5e6fbafbb 7b94dd326f6f1 d51 51 553e8fa57f6849ebb0 
82077b62b2dc216051f339d53ec8a737 151 4fec6083ddb7dc22bc7ff0abfcf54 
25fe3ec63ee93115e2bdf21df72c811fc9a4c1 cead59c10346e7ff70c2cba8c32 
e47058323d68aceabb1abd44e2a01d7846a19e37c19b0cb07d2eb6cc4fea77e1 
fd9f3787b68f543ff2a472b7d037084601 ef33d6111c91abO0b0dec4bbbcf93da 
7b2d1badf1dbc5c3b9f3d78f90c0ec2bdba52b70e6b235c3c0689aeal 7073753 
56ee556a6f6afccd14e2ab22dffcb5d102d474221 6a6a2c640eadf5f368c60b8 
1e8896de7976350abcdf43 19e846eda06a24a05806c589a9235c6a6d61 Ocd009 
4839206b6b4d1166f009e8ef396bb5c2a59983be5c1 2de4c54e58ce8da3b081f 
e487aecad47c81 270513404 bb5f12347249dc4f1e401 cb99f6efb1be1783052c 
54b6e76217c78e631418c56c1 78feaeaeea2eaeb975a87 1e915dd69314cea08c 
8d3c0cb1dbbc090834673db1 Obdf056bd350babe1ce6bf30926e16fe6e864b82 
3306424a330c2825ee75c0979cd62a7304c1e50a869e4688765a37c7c3a60f96 
92a268ff0f59c4222cee4 38c6d5fdcfebcb29fda014a9d458701ceab34204b79 
cdbd/cba3fd1963beb79aa159f20103952feebf62de75a739073b08c3c6f7 bbc 
046f32f43f82f6a4 75cc211 cadbe25f8df983efab3053fd256a5072d9506b4f3 
7491dc14d2ec88698a1758e4cd930522f4d3a68d 1fb8130adb758 18f94d 10fes 
93a2fdc063c9bd 169f2e7664fa5d8a1484ca97 725eb8134d543d7a6d07b2b0d0 
8e5089260064a9558 1 9a92ebccc43d05520e32d234dd3c1 76bed5f6d0665ebdb 
27d900a302faffbdf9145b802ee32779f4841 7637ea94 70d06f27 72a2aeebe08 
fde9624050c1f5cd620568edd5260e1 7f234c07539a843531 6bf3b9fc4350503 
e08d3303ca393e63c2d202d8a82abe3037f99ebb7 Ob8F3 1 2f86ed59eae20d888 


3ab78388338a4de158a445d338389abf70268cfee474ba06a64d15ba21b783d6 
7c5cdc5b738f5d7b401 40f2cc0a73db61845b45cbc2a297bee2d950657cab658 
15dafe76124cb0239e7593932864feddefc1 2cfe2243f3ca51c968c597bb62c5 
7617fa1febbd7a84d93de644288d4b957564439fecf78129ccd4507ce700225e 
e151c10ca1bd2c8ec3dfa40359540277 8c44287819362151ae647c11febaa91e 
63f8450d3c9f65a624fa65d8e7 60fb3baf430de9ebdff4efc096e7f3e2ac756b 
ceffc6c32571a6ae037ace1 8409e4 79ab6cef4d6f58e0258ec206d7 9abdfabde2d 
4344e4f149509864 11 5bcf80b5b1613ca270c72ec6f8fb0497 1bdc7af4a40a66 
b8ffa044c1aa76470b3ad334f834da7 77ef71e8532497610d00b128d37fc6a54 
a/5fa23ea816abe4a2ada311 82aea5bb1 274831 7be14ef2808607070d92cbefc 
791995d3e1cfd697b9ad833e1 712357a476f1538c38a001925ce94d3ae39edb8 
2259e2aebc1913304c78125e6c1 2e0924b34.ab11d3e848078579598f1c21ed53 
c0285a05f35e5c7ac9b/7436dcc0fdefb62400b8d869e55141a7ea84268ae970a 
5cd2567af0ff3 769b687ad9feacf8c52eb71'614e2b74ad3b0cb43730c1 edOfbf 
3fa0467b0065337 1f6ebc7dc291 50664ad6e46c5 75ef0ca84a1c99ea1ece8304 
72607c¢261f87955ff646339ff7063bebdc17450a24ef35233ef9c31d349c2853 
0d1e9dedd01466b3af161 8afa5a68f09c539ab7e18c051d7fbad39167b408532 
24dca7 1173df1041b4001384ca041a43e131 75ed76289269babb0dc99e0967 bc 
face11cb17a829f57724e785d82da0a66440ba7602b825b9a7a1 0be84b933f10 
ae20504e6fcab7ebe3f0231 f8f3361d762ff27 bb6b5ca475d3b051f6c7a1411F 
aa643c7015e6756d6ecd40516e6ad89421c700b79ce7 3f025f85dd8bc5b403e7 
8a08d 166de1 54bb0fc1f896 7e5cd532c8e220467e3c500c26e80678c89ce4 999 
f2ff6cObd9769a73702ba3e8841fb336c688ea576574485'2 1 4bef292883e0f4 
05a309eed80bae33ef2b1 4f7a27 eb3ead 1b986e52e697fd19d09a61a336dfebb 
75a5322c544ee488e43b4 fbacd2ced7baa0be9f8b39a97 a52826f7f4f848256e 
291b9973fe526ce919aa0380023a5196486ef1 a0dc9725ff294ce0d707a6f8de 
3750426d803ed01969ed3b/7 2f4fa44ba882eff093be461 23f0b033e661 2eb074 
43d193a8aca0282af9924d9b39f61a9e13382389F1f4ae2995ebc56 1 ed628ef6 
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07. Conclusion 


Despite the ongoing Law Enforcement and community response actions targeting and aiming to 
disrupt the Emotet botnet we believe that systematically and persistently monitoring the Emotet 
botnet would prove to provide valuable results for the security community and Law Enforcement for 
the purpose of tracking down monitoring and attempting to shut down the Emotet botnet. 


We will continue providing relevant and related case studies on various botnets that are currently in 
circulation using Maltego and WhoisXML API for the purpose of establishing the foundations for a 
successful botnet C&C infrastructure monitoring and mapping including active cyber attack attribution 
campaigns. 


